Small correction - it asks for your device password (try it yourself if you use the chrome password manager). In this case something with NoMachine exposed/dis

Small correction - it asks for your device password (try it yourself if you use the chrome password manager). In this case something with NoMachine exposed/disabled the device password as well. Essentially the OP's configuration allowed an attacker unfettered access to the machine while a "blessed" chrome session was still active and had their master password stored in Safari.